4 ms·

Link to the infringing source, for the curious: https://github.com/ncw/rclone/blob/a9d29c22645c9b5d2ab938ebbbed0809a2044087/amazonclouddrive/amazonclouddrive.g

Link to the infringing source, for the curious: https://github.com/ncw/rclone/blob/a9d29c22645c9b5d2ab938ebbbed0809a2044087/amazonclouddrive/amazonclouddrive.go#L37-L38 https://github.com/ncw/rclone/blob/a9d29c22645c9b5d2ab938ebb...

msravi 9y ago
> My guess is that the software will probably just require users to get their own secrets as part of the initial configuration. Amazon has stopped giving out any more API keys (https://developer.amazon.com/amazon-drive https://developer.amazon.com/amazon-drive). So I guess that isn't an option unless Amazon opens it up again...
bm1362 9y ago
So is this basically sharing the same API key? Wouldn't that make using this insecure, as you'd be seeing the same data as other rclone users?
- koolba 9y ago
  Not if the source data is encrypted using a local key. What may be possible is deleting other user's data as I believe it'd all be authorized with the same API key.
  - tgsovlerkhgsel 9y ago
    In OAuth, you have basically two tokens: One for the "software"/"third party service provider", one for the account itself. So for example, if you want to use SomeMagicTweetTool to send tweets, they use their token to prove it's them, and you grant them a special token for your account. Someone who has their token can pretend to be them, use their quota if there is per-software/per-provider quota, but cannot access your account unless you gave them a token for your account.
niftich 9y ago
See also, the de-obfuscation wrapper [1], decryption implementation [2], and the key [3]. [1] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce56647b63488599d1b95/fs/config.go#L161-L185 https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664... [2] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce56647b63488599d1b95/fs/config.go#L118-L134 https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664... [3] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce56647b63488599d1b95/fs/config.go#L106-L116 https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664...

msravi 9y ago

> My guess is that the software will probably just require users to get their own secrets as part of the initial configuration. Amazon has stopped giving out any more API keys (https://developer.amazon.com/amazon-drive https://developer.amazon.com/amazon-drive). So I guess that isn't an option unless Amazon opens it up again...

bm1362 9y ago

So is this basically sharing the same API key? Wouldn't that make using this insecure, as you'd be seeing the same data as other rclone users?

koolba 9y ago
Not if the source data is encrypted using a local key. What may be possible is deleting other user's data as I believe it'd all be authorized with the same API key.
- tgsovlerkhgsel 9y ago
  In OAuth, you have basically two tokens: One for the "software"/"third party service provider", one for the account itself. So for example, if you want to use SomeMagicTweetTool to send tweets, they use their token to prove it's them, and you grant them a special token for your account. Someone who has their token can pretend to be them, use their quota if there is per-software/per-provider quota, but cannot access your account unless you gave them a token for your account.

niftich 9y ago

See also, the de-obfuscation wrapper [1], decryption implementation [2], and the key [3]. [1] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce56647b63488599d1b95/fs/config.go#L161-L185 https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664... [2] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce56647b63488599d1b95/fs/config.go#L118-L134 https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664... [3] https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce56647b63488599d1b95/fs/config.go#L106-L116 https://github.com/ncw/rclone/blob/66e8c1600ec8c18cbcdce5664...